REMARKS 



This paper and the accompanying Request for Continued Examination (RCE) are being 
submitted in response to the Final Office Action dated November 1, 2005 , and subsequent 
Advisory Action dated January 24, 2006, having a shortened statutory period set to expire on 
March 1,2006. 

Claims 1, 2, 4-10, 12-17 and 19-30 are pending in the application. 
Claims 1, 2, 4-10, 12-17 and 19-30 have been rejected. 
Claims 1,9, 16, and 23-30 have been amended. 
Claims 31-34 have been added. 

As an initial matter, Applicants note that certain claims have been amended to address 
informalities in those claims; such claims have not been amended to respond to the substantive 
rejection, which is responded to by the remarks presented below. Applicants further note that 
certain of the claims (e.g., Claims 1, 9 and 16) have been amended simply to improve clarity. In 
clarifying the claim language, these amendments are not intended to limit the scope of the 
claims, unless the claim language is explicitly referred to in the following arguments to 
distinguish over one or more of the cited references. 

Rejection o f Claims under 35 U.S.C. § 103 

Claims 1, 2, 4-10, 12-17 and 19-30 stand rejected under 35 U.S.C. § 103(a) as being 
rendered obvious by U.S. Patent No. 6,570,875, issued to Hegde ("Hegde") in view of U.S. 
Patent No. 5,884,080, issued to Blandy ("Blandy"), and, for some claims, one or more additional 
references. Applicants respectfully traverse these rejections. - 
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In order for a claim to be rendered invalid under 35 U.S.C. § 103, the subject matter of 
the claim as a whole would have to be obvious to a person of ordinary skill in the art at the time 
the invention was made. See 35 U.S.C. § 103(a). This requires: (1) the reference(s) must teach 
or suggest all of the claim limitations; (2) there must be some teaching, suggestion or motivation 
to combine references either in the references themselves or in the knowledge of the art; and (3) 
there must be a reasonable expectation of success. See MPEP 2143; MPEP 2143.03; In re 
Rouffet, 149 F.3d 1350, 1355-56 (Fed. Cir. 1998). The burden is on the examiner to support a 
case of obviousness, including whether the prior art references teach or suggest all of the claim 
limitations. See MPEP 706.02(j). Applicants respectfully submit that the arguments presented 
by the Examiner in the present Final Office action dated November 1, 2005 ("Final Office 
Action") and subsequent Advisory Action fail to establish all of these requisite criteria for 
rendering the pending claims of the application unpatentable. In light of the discussion below, 
Applicants respectfully request that the Examiner withdraw the rejections and provide a notice of 
allowability for all pending claims. 

Independent Claims 1, 9, 16 and 23: 

Independent Claims 1,9, 16 and 23 all stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Hegde in view of Blandy. Applicants respectfully traverse these rejections. 

"Determining whether to Process the Group of Information for Network Traffic Data 
Collection " (Hegde) 

Each of the independent claims contains a limitation substantially of the form 
"determining whether to process the group of information for network traffic data collection" 
See, e.g., Claim 1. The application discloses "network traffic data" to include source, 
destination, protocol, type of service, number of packets in a traffic flow, total number of bytes 
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in a traffic flow, first and last time stamps of packets switched as part of a flow, etc. See 
Application, pp. 10-11. Network traffic data can be used for purposes such as network analysis 
and planning, network management, accounting, billing, and data mining. Network traffic data 
further enables network managers to monitor network traffic, determine bandwidth requirements, 
insure quality of service compliance, and fine-tune network performance. See Application, p. 1 1. 

The clear language of the claims provide for determining whether to process the group of 
information and conversely, by implication, whether to not process the group of information. 
While the Final Office action suggests that various sections of Hegde provide disclosure of the 
referenced claim limitation, Applicants respectfully submit, and establish below, that none of the 
cited sections of Hegde provide disclosure of determining whether to process a group of 
information for network traffic data collection as that term is defined by the present application, 
this is because the disclosed Hegde device has no capacity to not process packets, since every 
packet passing through Hegde's device must be processed in order for Hegde's device to 
function properly. 

The Final Office action lists the following sections as providing disclosure of determining 
whether to process a group of information: 

(1) Fig. 2, IP packet: Applicants respectfully submit that the referenced IP packet is not 

illustrated in Fig. 2. Even were an IP packet illustrated, Applicants 
submit that such an illustration would not disclose the claim 
limitation. 

(2) Hegde 4:34-53: The cited section purports to describe a multiprotocol switch that is 

disclosed to have the ability to forward packets among and 
between local nodes and external networks that are attached to the 
multiprotocol switch. The cited section also purports to describe 
parts of Fig. 2, including a flow table 70 disclosed to be a mapped 
memory space accessible to switch module 60 and CPU 80. 
Applicants respectfully submit that no language within this section 
of Hegde discloses the claim limitation. 

(3) Hegde 5:30-50: The cited section purports to describe, inter alia, a "routing 

domain" defined as multiple ports belonging to a same IP or IPX 
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network or having the same IP or IPX address and subnet mask. 
The cited section also states that "switch module 60 continually 
monitors each of the ports for incoming traffic." Hegde 5:40-41. 
The cited section further discloses that whenever a data packet 
arrives, the packet header is checked for information identifying a 
data flow to which the packet belongs. Hegde 5:41-43. Applicants 
respectfully submit that the cited section provides no disclosure of 
determining whether to process a group of information. The cited 
section merely links a packet with a data flow and extracts the 
linking information from each packet received by the disclosed 
device. 

(4) Fig.7 (S30 & S32): Step 30 illustrated in Fig. 7 is a conditional determining whether 

a packet is of an IP/IPX or ARP/RARP type. Step 32 illustrates 
processing a packet at Layer 3+ (L3) if the conditional in Step 30 
is met. If the conditional in Step 30 is not met, then the packet is 
illustrated as being processed at Layer 2 (L2) in Step 26. 
Applicants respectfully submit that there is no disclosure in Fig. 7 
of determining whether to process a group of information or not. 
Instead Fig. 7 selects a processing type based upon whether a 
packet should be processed at L2 or L3. Each packet received by 
Hegde is so processed, either at L2 or L3. 

(5) Hegde 8:25-9:39: This cited section purports to describe the algorithm illustrated in 

the flow chart of Fig. 7. The cited section contains the following 
disclosure: 

o The switch engine continually monitors for data packets (Hegde 
8:18-19) and each packet is processed according to Fig. 7 (Hegde 
8:21-23); 

o IGMP processing occurs to keep multicast tables up-to-date 
(Hegde 8:23-31); 

o Fig. 7 illustrates steps in packet processing and switching for each 
packet (Hegde 8:32-34); 

o For S20, if a packet is multicast, then packet information is 

forwarded to a CPU to update VLAN information per S22 (Hegde 
8:35-42); 

o For S24, a check is made to see if L3 processing is enabled, and if 
not then all packets are processed at layer 2 per S26 (Hegde 8:43- 
49); 

o A description is provided as to how protocols used by hosts can be 
determined by looking at an Ethernet packet header (Hegde 8:50- 
64), identifying layer 4 protocols in layer 3 headers (Hegde 8:65- 
9:9), identifying IPX protocols (Hegde 9:10-20), and thereby 
identifying an associated flow of a packet by examining source and 
destination or socket information in an appropriate L2 or L3 packet 
header (Hegde 9:21-26); 
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o For S28, determining a packet protocol type (Hegde 9:30-31); for 
S30, if a packet is not IP/IPX or ARP/RARP, then processing the 
packet as an L2 packet (Hegde 9:34-37); and 

o For S32 processing appropriate packets in accord with L3+ 
protocols (Hegde 9:37-40). 

Applicants respectfully submit that this cited section of Hegde 
provides no disclosure of determining whether to process a group 
of information as claimed. Instead, the disclosed processing 
relates to whether to perform L2, L3 or multicast VLAN updating. 
Applicants further submit that the entirety of the cited text relates 
to determining a type of protocol for each data packet and basing a 
L2 or L3 processing decision on that. No determination of whether 
or not to process a particular packet is made, since each and every 
packet received is processed in some way. Further, the disclosure 
does not relate to determining whether to process a group of 
information for network traffic data collection as that term is 
defined within the present application. 

The Final Office Action further lists the following sections of Hegde as providing 
disclosure of determining whether to process a group of information for network traffic data 
collection: 

(1) Fig.8 (S42 & S44): Step S42 of Fig. 8 is a purported illustration of checking a flow 

table for source and destination entries. This step is disclosed as 
part of the L3 processing from Step S32 in Fig. 7, which is 
performed after determining the L3 source and destination. Hegde 
9:44-49. Based upon the checking of the flow table, Step S44 
contains a conditional that provides for forwarding the packet 
according to flow table instructions if there is a flow entry already 
in the flow table (Hegde 9:50-51), and resolving the flow to 
provide forwarding information and links if there are not entries 
for the source and destination in the flow table (Hegde 9:56- 
10:23). In neither case is a determination made as to whether to 
process a group of information for network data collection, since 
for each packet the packet is either forwarded according to present 
information in a flow table or new flow table information is 
generated. Further, even though L3 source and destination is 
determined, there is no disclosure of collection of data as claimed. 

(2) Hegde 2:65-3:9: This section of the Summary of the Invention relates to 

determination of associated flow from examination of an incoming 
packet (Hegde 2:65-67), and a flow table is examined to determine 
whether it contains forwarding information associated with the 
packets flow (Hegde 2:67-3:2). If the flow table does not contain a 
matching flow entry to the packet, then the CPU updates the flow 
table with the new forwarding information that can then be applied 
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to all future packets of the same flow (Hegde 3:2-6). Again, the 
cited section provides no disclosure of determining whether to 
process a group of information for network traffic data collection. 
Rather, the section discloses examining each incoming packet and 
updating a flow table. 

Updating a flow table is distinct from network traffic data 
collection. Claim 4 of the present application illustrates this 
distinction by providing for determining routing and forwarding 
information for the group of information as a separate concept. In 
addition, even Claim 1 distinguishes between "determining" and 
"forwarding," with a separate and distinct forwarding limitation 
from the determining limitation. 

(3) Hegde 9:40-55: This section of Hegde discusses Fig. 8. Fig. 8 is disclosed to 

illustrate switch engine processing of L3 packets (Hegde 9:40-42). 
The source and destination are extracted from an L3 header for 
each packet being L3 processed (Hegde 9:44-49). "Switch engine 
100 then checks to see whether entries exist in the flow table for 
both ends of the flow (step S42). If entries exist for both ends of 
the flow (determined in step S44), the packet is forwarded at wire 
speed in accordance with any filters, mirrors, priorities or VLANs 
established in the flow table entry (Step S46)." Hegde 9:50-55. 
Applicants submit that this provides disclosure for determining 
whether a flow table contains instructions for forwarding a 
received packet in an indicated flow. No disclosure is provided for 
determining whether to process a group of information for network 
traffic data collection, as each L3 processed packet is examined 
and no "determining" is performed, nor is network traffic data 
collection addressed. 

For the above reasons, Applicants respectfully submit that none of the cited sections of 
Hegde provide disclosure for the claim limitation of "determining whether to process the group 
of information for network traffic data collection." As stated above, each packet received by the 
Hegde router must be examined and processed either as an L2 or L3 packet. Therefore, there is 
no determination in Hegde of whether or not to process a packet. 

Further, none of the cited disclosure provides for network traffic data collection. Instead, 
Hegde either performs an L2 or L3 check or updates a flow table entry, which is distinct from 
network traffic data collection. 
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"Selecting the Group of In formation Based on an Examination of Traffic Attribute Data" 
(Hegde) 

The Final Office Action further cites to Hegde for the proposition that Hegde discloses 
the claim limitation "determining whether to process the group of information for network traffic 
data collection wherein said determining is performed according to a sampling algorithm that is 
selected from one of . . . selecting the group of information based on an examination of traffic 
attribute data in the group of information." See, e.g., Claim 1. Applicants note that Claims 1, 9 
and 16 have been amended to remove this claim limitation and that therefore this rejection as 
applied to those claims is rendered moot. However, since a similar limitation is present in 
dependent Claim 25 and new dependent Claims 31-33, Applicants will respond to the substance 
of the rejection here. 

As an initial matter, Applicants submit that in light of the above discussion, Hegde does 
not disclose "determining whether to process the group of information for network traffic data 
collection," and therefore cannot disclose this additional limitation. As a second matter, 
Applicants respectfully submit that each of Claims 25 and 31-33 require selecting a sample 
algorithm from a list that includes examining traffic attribute data in the group of information. 
None of the cited disclosure provides for selection of a sample algorithm from such a list. 

Applicants further respond to the citations provided in the Final Office Action: 

(1) Fig. 8 (S48 & S54): Step S48 of Fig. 8 is a conditional entitled "Only Destination 

Unresolved?" Hegde states "if only the destination end of the flow 
was unresolved (determined in step S48), a flow table entry exists 
for the source end of the flow, containing a broadcast enable entry 
for the source. Accordingly, switch engine 1 00 forwards the 
packet on the port(s) indicated by the broadcast enable entry 
associated with the source (step S56)." (Hegde 9:59-65). 
Similarly, Step S54 in Fig. 8 is a conditional entitled "Only Source 
Unresolved?" Hegde suggests that such packets are forwarded to 
the CPU to create a flow table entry (Hegde 9:66-10:1 1). 
Applicants respectfully submit that these conditionals for Fig. 8 
determine an action to take place based on whether information in 
a packet header is present in a flow table. These steps do not 
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disclose selecting a group of information based on an examination 
of traffic attribute data in the group of information as an aid to 
determining whether to process the group of information for 
network traffic data collection, because there is no network traffic 
data collection disclosed nor is there any selection of the group of 
information. 

(2) Hegde 9:40-55: This section of text in Hegde is discussed in the above section. For 

the reasons cited above, Applicants respectfully submit that this 
section does not disclose the cited claim limitation. 

(3) Hegde 10:35-42: This text purports to describe Fig. 9, which is indicated to be CPU 

processing of unresolved L3 packets. Fig. 9 discusses creating a 
flow table entry for unresolved sources which includes filters, 
mirrors and priorities associated with such a source using a flow 
table from Fig. 10 (Hegde 10:35-42). Applicants respectfully 
submit that this section does not provide for the claimed selecting a 
group of information based on an examination of traffic attribute 
data in the group of information as an aid to determining whether 
to process the group of information for network traffic data 
collection, because there is no network traffic data collection 
disclosed nor is there any selection of the group of information. 

In light of the above discussion, Applicants respectfully submit that the cited sections of 
Hegde do not disclose the referenced limitation of dependent Claims 25 and 31-33. 

Selecting Based on Burst Sample Algorithm (Blandv) 

The Final Office Action suggests that Blandy teaches the claim limitation "determining 
whether to process the group of information for network traffic data collection, wherein said 
determining is performed according to a sampling algorithm that is selected from one of ... a 
burst sampling algorithm, and selecting the group of information based on an examination of 
traffic attribute data in the group of information." See Claim 1. Applicants note that Claims 1, 9 
and 16 have been amended to remove this claim limitation and that therefore this rejection as 
applied to those claims is rendered moot. However, since a similar limitation is present in 
dependent Claim 25 and new dependent Claims 31-33, Applicants will respond to the substance 
of the rejection here. 
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As an initial matter, Applicants submit that in light of the above discussion, Hegde does 
not disclose "determining whether to process the group of information for network traffic data 
collection," and therefore cannot disclose this additional limitation. As a second matter, 
Applicants respectfully submit that each of Claims 25 and 31-33 require selecting a sample 
algorithm from a list that includes a burst sampling algorithm. None of the cited disclosure 
provides for selection of a burst sample algorithm from such a list. 

The Final Office Action cites to the following sections as purportedly providing 
disclosure of this limitation: 

(1) Fig. 2: Fig. 2 is a flow chart presented to illustrate how performance monitoring 

is enabled or initiated according to Blandy (Blandy 3:36-37 and 
4:27-5:27). No determination of whether to process a group of 
information is made in any of the disclosure provided for Fig. 2. 

(2) Fig. 3: Fig. 3 is a flow chart presented to illustrate a method of handling external 

interrupts (Blandy 3:38-39 and 5:28-6:24). The disclosure states 
that if a performance monitor interrupt is received, then a burst 
mask is read to determine how many instructions to monitor and 
such information is propagated to all processors in a symmetric 
multiprocessing environment. The disclosure also provides for 
slowing the rate of system timer interrupts to prevent time 
interrupts from constantly occurring while a system is being 
monitored. 

Applicants respectfully submit that neither Figs. 2 or 3 disclose 
selecting a burst sampling algorithm for determining whether to 
process a group of data for network traffic data collection. Fig. 2, 
as stated above, only purportedly illustrates initiating a system for 
monitoring performance of various processors. Fig. 3 provides 
only a method of handling external interrupts for beginning the 
sampling of instructions on a set of multiprocessors. Blandy 
discloses a burst mask to set a number of instructions monitored 
over a set of intervals and does not relate this to network traffic 
monitoring nor does Hegde. 

(3) Blandy 2:64-66: The cited section states "accordingly, the present invention is 

directed to a system and method for monitoring system 
performance by sampling instructions in a burst mode, rather than 
once per interrupt." (emphasis added). Applicants respectfully 
submit that the cited section provides no disclosure of selecting a 
burst sampling algorithm being used to determine whether to 
process a group of information for network traffic data collection. 



-18- 



SerialNo.: 09/779,248 



PATENT 



Monitoring system performance is not network traffic data 
collection. Further, there is no selection of the burst sampling 
algorithm as claimed. 

(4) Blandy 3:12-19: The cited section discusses burst sampling of executed instructions 

in a symmetric multiprocessing environment by giving each 
processor its own dynamic tree structure. Applicants respectfully 
submit that this section has no relation to the claim language. 
Mere mention of burst sampling being performed in a context 
unrelated to the claim does not disclose the claim language. 

(5) Blandy 4:26-50: The cited section discusses Fig. 2, which is discussed above. For 

the reasons cited above, Applicants respectfully submit that this 
cited section contains no disclosure of the claim language. 

For these reasons cited above, Applicants respectfully submit that Blandy provides no 
disclosure of selecting a burst sampling algorithm to determine whether to process a group of 
information for network traffic data collection. Applicants further submit that the cited sections 
provide no disclosure of selecting a burst sampling algorithm to select any type of information, 
and instead relate only to configuring a system to utilize sampling of processor instructions. 

Selecting Based on Examination of Traffic Attribute Data (Blandy) 

The Final Office Action further cites Blandy against selecting a group of information 
based on an examination of traffic attribute data in the group of information for determining 
whether to process a group of information for network traffic data collection. Applicants note 
that Claims 1, 9 and 16 have been amended to remove this claim limitation and that therefore this 
rejection as applied to those claims is rendered moot. However, since a similar limitation is 
present in dependent Claim 25 and new dependent Claims 31-33, Applicants will respond to the 
substance of the rejection here. 

As an initial matter, Applicants submit that in light of the above discussion, Hegde does 

not disclose "determining whether to process the group of information for network traffic data 

collection," and therefore cannot disclose this additional limitation. As a second matter, 

Applicants respectfully submit that each of Claims 25 and 31-33 require selecting a sample 
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disclosure provides for selection of examination of traffic attribute data from such a list. 

The Final Office Action cites to the following sections of Blandy as purportedly 
providing disclosure of this limitation: 

(1) Fig. 2 (33-39): As discussed above, the cited elements relate only to configuring 

the burst sampling of processor instructions in a configurable 
multiprocessor system, by using a burst mask. Applicants 
respectfully submit that the cited steps do not relate to selecting an 
examination of traffic attribute data in order to select a group of 
information as claimed, since no information from the claimed 
group of information is used. 

(2) Fig. 3 (41-58): The cited elements include each step that is illustrated in Fig. 3 and 

which are discussed above. Again, at best the cited disclosure 
relates only to a burst sampling algorithm being configured in a 
symmetric multiprocessor environment and not to selecting 
examination of traffic attribute data to select a group of 
information for processing as claimed. 

(3) Blandy 4:30-6:26: These cited sections are an explanation of Figs. 2 and 3 discussed 

above. The Final Office Action submits that this explanation 
relates to "setting/allocating data according to time/count of traffic 
data." Applicants respectfully submit that this is not disclosed in 
the cited section. The burst sampling that is purported to be 
initiated by the disclosure is based on a burst mask that sets how 
many instructions will be monitored in an interval and a response 
to an external interrupt. Applicants submit that the burst mask and 
the external interrupt are not provided by the data being monitored 
and therefore there is no selection of a group of information based 
on an examination of the traffic attribute data in that group of 
information as claimed. 

For the above reasons, Applicants respectfully submit that Blandy fails to provide 
disclosure of selecting a burst algorithm or examination of traffic attribute data to select a group 
of information, both of which can be used to determine whether to process the group of 
information for network traffic data collection. 

No Suggestion To Combine References 

The Final Office Action responds to Applicants previous discussion that there is no 

suggestion to combine the references by stating, "it would have been obvious to one having 
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ordinary skill in the art at the time the invention was made to provide a burst sampling algorithm, 
as taught by Blandy in the system of Hegde, so that it would provide a performance system 
monitor system performance [sic] with minimal changes to the operating system and no changes 
to application code; also it would provides mechanism for monitoring system performance by 
sampling in a burst mode, rather than once per interrupt." Final Office Action, pp. 1 9-20. As an 
initial matter, due to the wording chosen for the Final Office Action, Applicants are not certain 
what the Examiner believes is taught by the combination of the references (e.g., "a performance 
system monitor system performance"). Nonetheless, Applicants respond to the best of their 
understanding. 

Applicants respectfully submit that the quoted statement does not provide a suggestion to 
combine the references to achieve the claimed invention. The claimed invention is related to the 
field of network traffic data monitoring (as that phrase is defined in the present application). 
Neither Hegde nor Blandy is related to network traffic data monitoring. A person of ordinary 
skill in the art would not be motivated, based upon the disclosure in either reference, to combine 
Blandy' s purported mechanism for monitoring processor instruction statistics in a set of 
symmetric multiprocessors with the flow-table router system of Hegde to achieve the claimed 
invention. 

Even were a person of ordinary skill in the art to consider the Blandy disclosure as 
relevant to the field of network data collection, given that the Hegde router must analyze every 
packet that passes through the router to make the disclosed flow forwarding decisions, there 
would be no motivation to combine such disclosure with any reference that suggests not 
analyzing every packet that passes through the router (e.g., Blandy). Further, since Hegde 
provides no disclosure or discussion of sampling algorithms, one would not be motivated by' 
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alternate sampling methods to combine Hegde with any other reference disclosing such alternate 
sampling methods. 

No Reasonable Expectation of Success 

The Final Office Action also states "in response to Applicant's argument that one would 
not expect success from combining, the test for obviousness is not whether the features of a 
secondary reference may be bodily incorporated into the structure of the primary reference; nor 
is it that the claimed invention must be expressly suggested in any one or all of the references." 
A requirement for obviousness is that there must be a reasonable expectation of success in the 
combination of the references. See MPEP 2143; MPEP 2143.03; In re Rouffet, 149 F.3d 1350, 
1355-56 (Fed. Cir. 1998). In Applicants' response to the Office Action dated September 21, 
2005, Applicants established that there is no reasonable expectation of success in the combining 
of Hegde with Blandy. See Response to Non-Final Office Action, pp. 14-15. Applicants 
specifically incorporate that argument herein. To summarize that discussion, Applicants submit 
that if a Hegde device does not analyze at least the source and destination of each received 
packet, then the Hegde device cannot effectively update flow tables. Therefore, there can be no 
expectation of success of a combination of Hegde with any disclosure suggesting anything but 
analysis of every packet arriving at a Hegde device. Sampling packets is contrary to the Hegde 
disclosure, unless all packets are considered a "sample," which contradicts the claims and 
disclosure of the present Application. Further, there is no indication within Hegde or Blandy that 
the use of Blandy' s interrupt driven system can function to sample network traffic data, nor has 
the Examiner presented any rationale for the functionality of such an interrupt driven system in 
sampling network traffic data. Burst sampling as described in the present application relates to 
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sampling a set number of packets, while Blandy discloses setting a burst collection time period 
based on a number of interrupts. 

For all of the above reasons, Applicants respectfully submit that independent Claims 1, 9, 
16 and 23 as amended, and all claims dependent thereon, are in condition for allowance. 
Applicants therefore respectfully request withdrawal of the final rejection and an indication of 
allowance of all claims in the present application. 

CONCLUSION 

The application is believed to be in condition for allowance, and a notice to that effect is 
solicited. Nonetheless, should any issues remain that might be subject to resolution through a 
telephonic interview, the Examiner is invited to telephone the undersigned. 
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